[php-src] Issue #20668: global buffer overflow in url.c

[email protected] (chongwick)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/20668
Author: chongwick

### Description

The following code:

```php
<?php
$v_8910 = 'file:///datafoo:test';
$v_5729 = Uri\WhatWg\Url::parse($v_8910,);
$v_5732 = $v_5729->getAsciiHost();
$v_5731 = $v_5729->withHost($v_5732,);
```

Resulted in this output:
```
=================================================================
==1246000==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000813571f at pc 0x000001d899fb bp 0x7fffbfdf62f0 sp 0x7fffbfdf62e8
READ of size 1 at 0x00000813571f thread T0
    #0 0x1d899fa in lxb_url_parse_basic_h /home/w023dtc/nightly_php/php-src/ext/lexbor/lexbor/url/url.c:2137:25
    #1 0x1d9a6b6 in lxb_url_host_set_h /home/w023dtc/nightly_php/php-src/ext/lexbor/lexbor/url/url.c:4351:14
    #2 0x1d9ab52 in lxb_url_api_hostname_set /home/w023dtc/nightly_php/php-src/ext/lexbor/lexbor/url/url.c:4315:12
    #3 0x47c5a72 in php_uri_parser_whatwg_host_write /home/w023dtc/nightly_php/php-src/ext/uri/uri_parser_whatwg.c:392:6
    #4 0x47ae77a in php_uri_property_write_helper /home/w023dtc/nightly_php/php-src/ext/uri/php_uri_common.c:86:6
    #5 0x47af746 in php_uri_property_write_str_or_null_helper /home/w023dtc/nightly_php/php-src/ext/uri/php_uri_common.c:123:2
    #6 0x4791261 in zim_Uri_Rfc3986_Uri_withHost /home/w023dtc/nightly_php/php-src/ext/uri/php_uri.c:618:2
    #7 0x5ef166b in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:2152:4
    #8 0x5c3068b in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:116212:12
    #9 0x5c32c1c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:121924:2
    #10 0x69c3b79 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1975:3
    #11 0x519095a in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2645:13
    #12 0x5191a98 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2685:9
    #13 0x69d8a8a in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:951:5
    #14 0x69d2e6f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1362:18
    #15 0x151e2b81ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #16 0x151e2b81ee3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #17 0x607b04 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x607b04)

0x00000813571f is located 1 bytes to the left of global variable '<string literal>' defined in '/home/w023dtc/nightly_php/php-src/ext/uri/uri_parser_whatwg.c:574:153' (0x8135720) of size 1
  '<string literal>' is ascii string ''
0x00000813571f is located 60 bytes to the right of global variable '<string literal>' defined in '/home/w023dtc/nightly_php/php-src/ext/uri/uri_parser_whatwg.c:574:146' (0x81356e0) of size 3
  '<string literal>' is ascii string ' ('
SUMMARY: AddressSanitizer: global-buffer-overflow /home/w023dtc/nightly_php/php-src/ext/lexbor/lexbor/url/url.c:2137:25 in lxb_url_parse_basic_h
Shadow bytes around the buggy address:
  0x00008101ea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101ead0: 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
=>0x00008101eae0: f9 f9 f9[f9]01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
  0x00008101eaf0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eb00: 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x00008101eb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008101eb30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1246000==ABORTING
```

But I expected this output instead:
```
```


### PHP Version

```plain
nightly
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.